The database fields available in this log format are defined in the log data; Sawmill extracts the names and types of the fields from the log data, and tracks all available fields in its reports. Sawmill generates reports for each field, and allows dynamic filtering on any combination of these fields.

Sawmill stores the following numerical fields in its database for Cisco IronPort Web Services Appliance (WSA S-Series) (W3C), aggregating them and including them as columns in most reports: